Data Platform Architecture and Technology Selection Questions

Lambda, Kappa, and pure-batch are three different answers to the same tension: how do you get correct results, quickly, without building the same logic twice.

The three architectures

Which fits a fintech workload needing strict correctness and sub-minute updates

Kappa is usually the better starting point here, not Lambda, despite Lambda's reputation as the "correctness" architecture. The reason is specific to this requirement: a fintech workload needs strict correctness AND sub-minute freshness, and Lambda's whole premise is that the fast path is allowed to be approximate until the batch path catches up, which is the opposite of what "strict correctness" demands. Kappa avoids maintaining two divergent codebases by making the single streaming pipeline capable of both live processing and full reprocessing (replaying the event log from the beginning when a bug fix or a definition change requires it), which keeps live and historical numbers consistent because they run through identical logic. The trade-off is that Kappa demands real engineering discipline: exactly-once processing guarantees, careful state management, and an event log retained long enough to support full reprocessing.

Pure batch is only viable here if "sub-minute updates" turns out, on closer questioning, to not actually be a hard requirement, since pure batch simply cannot deliver it by construction.

Trade-offs and pitfalls

Lambda's biggest real-world failure mode is exactly what it's often praised for avoiding: the two paths (streaming approximation, batch ground truth) computing the same business logic independently, in two different codebases, with two different engineers maintaining them, and slowly disagreeing on edge cases (how to handle a late-arriving refund, for instance) until nobody trusts either number without manually reconciling. Kappa avoids that specific failure mode by construction but shifts the burden onto the maturity of the streaming engine and the team's comfort with exactly-once semantics; adopting Kappa without that operational maturity in place just relocates the correctness risk rather than removing it.

When compute and storage costs on a data platform have grown too high, the fix has to separate three distinct cost drivers, wasteful storage tiering, wasteful compute usage patterns, and wasteful query design, because each has a different remedy.

Storage tiering

Move data that is rarely queried (older than, say, 90 days) from hot, expensive storage to a cheaper warm or cold tier, and delete or archive data past its actual retention requirement rather than keeping everything "just in case." This is usually the single largest and least risky lever, because it doesn't touch how anyone queries the data, only where it physically sits.

Materialized views and caching

If ad-hoc queries or dashboards repeatedly recompute the same aggregation from raw data, materializing that aggregation once (refreshed on a schedule matching how fresh the answer actually needs to be) turns many expensive scans into one cheap scan plus many cheap reads of the precomputed result. A result cache in front of the BI layer catches the common case of the exact same query being run many times a day by different dashboard viewers.

Compute autoscaling

For scheduled ETL (extract, transform, load) jobs on transient clusters, right-size the cluster to the actual job (a job that historically finishes with cluster utilization at 30 percent is over-provisioned) and ensure clusters actually shut down between runs rather than idling. For interactive query compute, autoscale down aggressively outside business hours rather than running a fixed-size warehouse around the clock.

Architectural changes

If ad-hoc analysts are scanning raw, unpartitioned files directly, partitioning and clustering the underlying tables on the columns those queries actually filter on (date, region, customer segment) is often the highest-leverage architectural fix, because it reduces bytes scanned per query regardless of who runs it or how often.

Worked example

Say ad-hoc queries against a raw events table currently scan the full table (say, 10 TB) on every query because it isn't partitioned by date, and analysts typically only care about the last 30 days. Partitioning by date so a typical query only scans the relevant 30-day slice (say, roughly 300 GB, if daily volume is even) cuts bytes-scanned-per-query by roughly 97 percent for that common access pattern, which for a byte-scanned pricing model translates almost directly into a proportional cost reduction on that workload, without changing a single line of the analyst-facing query.

Preserving query performance while cutting cost

The order of operations matters: apply storage tiering and partitioning first (these reduce cost without touching latency, and often improve it), then materialize the specific hot aggregations dashboards depend on (this improves latency while cutting cost), and only then look at autoscaling policy (which affects cost directly but needs headroom tuning to avoid introducing cold-start latency during traffic spikes). Cutting compute capacity before fixing the underlying query patterns just makes the same wasteful queries slower without actually reducing waste.

Trade-offs and pitfalls

The most common mistake is reaching for aggressive autoscaling or smaller compute allocations as the first lever, because it's the fastest change to make, without first fixing the partitioning and materialization issues that are the actual source of wasted spend; this trades a cost problem for a latency problem instead of solving either. The second is archiving or deleting data based on age alone without checking whether a specific, infrequently-run but business-critical report (an annual compliance report, say) still depends on it.

A data mesh decentralizes data ownership to the domain teams that generate it (marketing, orders, payments), each publishing "data products" with clear contracts, while a centralized platform keeps one team owning ingestion, transformation, and the warehouse for the whole company.

The comparison

Ownership: mesh puts the people closest to the data (who understand it best) in charge of its quality and its contract; centralized puts one platform team in charge of everyone's data, whether or not they understand every domain equally well.
Discoverability: mesh requires a strong shared catalog and standardized metadata across domains, or discovery becomes worse than centralized, since data is now scattered across many owners. Centralized discovery is simpler by construction because everything sits in one place.
Governance: mesh uses federated computational governance, shared standards enforced by tooling (schema validation, SLAs as code) rather than a single team manually reviewing everything; centralized governance is easier to enforce consistently because one team controls the whole pipeline, but that team becomes a bottleneck as the company grows.
Latency (time-to-new-data-product): mesh domain teams can ship a new data product without waiting on a central team's backlog; centralized platforms often become the bottleneck once a company has more than a handful of domains competing for the same platform team's attention.
Cost: mesh usually costs more in tooling and duplicated infrastructure across domains; centralized concentrates cost (and the ability to optimize it) in one place.
Developer velocity: mesh scales velocity horizontally (more domains means more parallel capacity) once the platform is mature; centralized velocity is capped by the size of the platform team, and that cap gets worse as the company scales.

When to favor each

Favor a centralized platform when the organization has fewer than roughly a dozen distinct data domains, when the central platform team is not yet a bottleneck, and when the cost and complexity of federated governance tooling would outweigh its benefit. A 50-person company with three product lines rarely needs a mesh; it needs a competent, well-staffed central team.

Favor a data mesh once a large organization has enough independent domains (order of dozens or more) that a central team has become the bottleneck for every new dataset, and once there is executive appetite to invest in the self-serve platform and governance tooling a mesh requires to avoid becoming an ungoverned mess of inconsistent, undiscoverable domain data. A mesh adopted before that tooling investment is made tends to produce exactly the failure mode critics warn about: each domain reinventing its own formats and quality bar, with no way to reliably query across domains.

Trade-offs and pitfalls

The most common mistake is adopting "data mesh" as an organizational restructuring (just move ownership to domain teams) without investing in the platform and governance tooling that makes federation work; the result is worse than a centralized platform, because now nobody is accountable for cross-domain consistency at all. The second is applying mesh principles to an organization too small to need them, which adds coordination overhead (data contracts, domain-team accountability meetings) that a single central team would have handled faster.

The core design choice is a federated operating model with central guardrails, not full centralization: domain teams own their data and remain accountable for its quality, while a small central governance function owns the shared standards, tooling, and the small set of policies that must be consistent everywhere (naming conventions for canonical entities, classification tiers, the schema-contract format, the escalation path for a cross-domain incident). This mirrors how a data-mesh migration frames domain-level responsibility with central guardrails: the mesh doesn't eliminate governance, it moves enforcement out of a central team's backlog and into each domain's own pipeline, backed by shared infrastructure the central team maintains.

Operating model

• Domain teams: own their source tables, their producer contracts, and first-line triage of quality incidents in their own data.
• Central governance function: owns the policy-as-code framework, the catalog, the classification standard, and cross-domain incident coordination. It sets the bar; it does not review every table.
• Federation boundary: a domain team can ship changes freely as long as they pass the shared automated gates; anything that would break a documented cross-domain contract requires the same CI-enforced compatibility check as any producer contract, not a manual sign-off meeting.

Technical controls and organizational changes

1. Ownership assignment. Every dataset with downstream consumers gets a named owning team in the catalog, not a person (people leave, teams persist). This is the single highest-leverage change: an unowned incident cannot be triaged.
2. Runbooks. Each owning team maintains a runbook for their domain's common failure modes (a stalled ingestion job, a schema-drift alert, a null-rate spike) so on-call response does not depend on institutional memory. Runbooks are checked into the same repo as the pipeline and reviewed on the same cadence as the code.
3. Policy-as-code. Classification rules, retention windows, and compatibility rules are expressed as machine-checkable policy (for example, Open Policy Agent rules or a custom linter run in CI) rather than a wiki page, so a violation fails a build instead of being caught in a quarterly audit.
4. Quality gates. Automated checks (freshness, null rate, referential integrity, schema compatibility) run on every load and block publication of a failing batch. This is what actually prevents incidents rather than just detecting them faster.

Concrete rollout: ownership plus runbooks as the first program elements, over 12 months, by vertical

Rather than rolling out to "dozens of teams" simultaneously, sequence by business vertical so the program proves itself before it scales. A realistic first-year plan:

• Months 1-3: pick one vertical, for example the CRM (customer relationship management) domain, as the pilot. Assign explicit ownership for every CRM-sourced table with downstream consumers, write the first runbooks for its two or three most common incident types, and stand up the quality gates on ingestion. This is deliberately narrow so the pattern can be validated before it is asked of teams who did not choose it.
• Months 4-6: extend the same ownership-assignment-plus-runbook pattern to a second vertical with materially different risk profile, for example finance data (where compatibility breaks have compliance consequences, not just dashboard noise). This tests whether the guardrails generalize or were accidentally tuned to CRM's shape of problem.
• Months 7-9: roll the same pattern to the remaining domains in waves of a handful of teams at a time, reusing the policy-as-code rules and runbook templates built in the first two verticals rather than writing new tooling per team.
• Months 10-12: the central function shifts from active rollout to maintenance: quarterly policy review, an incident retrospective process, and a self-service onboarding path so a new team can adopt the standard without a central-team engagement.

What to measure to know it's working, not just running

Trade-offs and pitfalls

The biggest risk in this design is the central function drifting into a review bottleneck by accident: every "just this once" manual sign-off makes the next domain team expect the same, and the whole point of policy-as-code is to make the guardrail a build check, not a meeting. The other common failure is measuring activity instead of outcomes (number of runbooks written, number of tables catalogued) without ever checking whether incident counts actually fell; a program can look busy and still not be reducing the thing it was funded to reduce.

A data warehouse stores structured, cleaned data in a schema defined before you write it (schema-on-write), optimized for fast, repeatable SQL queries. A data lake stores data in its raw, often semi-structured or unstructured form in cheap object storage, with the schema applied when you read it (schema-on-read). A lakehouse adds warehouse-like guarantees, ACID (atomicity, consistency, isolation, durability) transactions, schema enforcement, and fast query performance, directly on top of lake storage, so you get one copy of the data serving both BI and machine learning workloads instead of two.

The three side by side

Where to put what, for a mid-size SaaS company at tens of millions of events/day

Raw events: land in object storage (S3 or equivalent) as the system of record, append-only, partitioned by date. This is the lake layer, and it stays cheap even as retention grows to years of history.
Curated BI tables: build these as warehouse tables (or lakehouse tables if you've adopted one) on top of the raw layer, modeled for the specific questions the business asks repeatedly (funnels, revenue, retention). This is where schema-on-write pays off: BI tools expect stable, typed schemas.
ML feature sets: these usually want the row-level, less-aggregated data that lives closer to the raw layer, but with reproducibility and point-in-time correctness that a bare lake doesn't guarantee. This is the strongest argument for adopting a lakehouse table format even before you need full BI-and-ML unification: it gives the ML team versioned, ACID-safe access to data that would otherwise require a second copy of the pipeline.

Trade-offs and pitfalls

The lakehouse's ACID guarantees are not free: someone still has to run compaction and manage table maintenance (small-file cleanup, log/manifest pruning), or the table format's benefits erode over months of high-frequency writes. A pure warehouse is simplest to operate at a small scale but tends to become the wrong long-term choice once machine learning or genuinely unstructured data (logs, images, free text) enters the picture, because forcing that data through schema-on-write either loses information or requires an awkward second raw-storage layer anyway. A common mistake is treating "lakehouse" as a single product decision: it is a pattern implemented via a table format on top of storage you already have, not something you buy instead of a lake.